MALICIOUS — 7921d2_e1c2d55d3e504ae38a7bda8203b8ac12.pdf

MALICIOUS — 7921d2_e1c2d55d3e504ae38a7bda8203b8ac12.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: d62995954ec59b5a0a6fc89b2667345614d48800c5a57aa504acc31521fbfb59
• SHA-1: f8f51a3bfa6ae058dab2c67931763f9aa080874c
• MD5: c3c07285c524180444a64949627cd193
• ssdeep: 768:egGzpDbryC1eL4FJJurN1xY3yBU2DCXRwc2c6zSB8qs53aNZc2hGw4uOAJ/rwV3l:bGFXFShiRZQqs5Kbhl2g/rwV3uKS8
• TLSH: T13833A0F351A7EC887ADB9B436DF200656149D68D5236EBA009C8376CC5BC6FDBD10A20
• Submitted as: 7921d2_e1c2d55d3e504ae38a7bda8203b8ac12.pdf
• File type: pdf · Size: 48231 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=how+to+play+chase+the+ace+pub+game, https://8341c07f-e293-4c91-acab-f83b07507d7c.filesusr.com/ugd/8d57bd_f9b53f8cc2e4436d83113bdc8372c0f1.pdf?index=true, https://d21c42f2-f97f-47e7-975f-75019f1d19f5.filesusr.com/ugd/3f2390_f2f937c966cc47c2b2664d0c7ebd53ef.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=how+to+play+chase+the+ace+pub+game
• https://8341c07f-e293-4c91-acab-f83b07507d7c.filesusr.com/ugd/8d57bd_f9b53f8cc2e4436d83113bdc8372c0f1.pdf?index=true
• https://d21c42f2-f97f-47e7-975f-75019f1d19f5.filesusr.com/ugd/3f2390_f2f937c966cc47c2b2664d0c7ebd53ef.pdf?index=true
• https://3169beff-ae0f-45d9-95e1-1394188f43b2.filesusr.com/ugd/95b9ea_6dc38ce46ed54c1fae3fe38e70908eae.pdf?index=true
• https://498b408a-669f-448f-b732-35b262930ebc.filesusr.com/ugd/23a6c3_3488dee78ea24edcb0d0ea6acbef51b5.pdf?index=true
• https://56840277-152b-4a88-ba14-4b133881100a.filesusr.com/ugd/b81754_a7f3d65df21d4a78b0b77760d2c58a0a.pdf?index=true
• https://9aa4c207-0d80-4b65-a776-918a64622cfc.filesusr.com/ugd/e00bd3_a3503313d7eb40628334f60ad669a140.pdf?index=true
• https://909ea305-8f66-40ee-855f-fc956213aa6f.filesusr.com/ugd/3d514e_eaa41431fc634d38bdc01af57c6907ed.pdf?index=true
• https://cdn.shopify.com/s/files/1/0438/2975/6066/files/literature_and_the_writing_process.pdf
• https://cdn.shopify.com/s/files/1/0484/0092/4824/files/parisian_chic_a_style_guide.pdf
• https://cdn.shopify.com/s/files/1/0428/9809/6284/files/divukurokilixaxe.pdf
• https://cdn.shopify.com/s/files/1/0434/1157/0838/files/genogram_template_online.pdf
• https://cdn.shopify.com/s/files/1/0431/7977/0019/files/free_printable_worksheets_for_elementary_students.pdf
• https://cdn.shopify.com/s/files/1/0428/6427/9718/files/zofabaza.pdf
• https://cdn.shopify.com/s/files/1/0431/3209/2573/files/neopets_chrome_extension.pdf
• https://cdn.shopify.com/s/files/1/0437/8807/5159/files/luzikunawusukalev.pdf
• https://cdn.shopify.com/s/files/1/0428/5032/0543/files/conte_cagliostro.pdf
• https://cdn.shopify.com/s/files/1/0440/6693/0840/files/93315143798.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• 8341c07f-e293-4c91-acab-f83b07507d7c.filesusr.com
• d21c42f2-f97f-47e7-975f-75019f1d19f5.filesusr.com
• 3169beff-ae0f-45d9-95e1-1394188f43b2.filesusr.com
• 498b408a-669f-448f-b732-35b262930ebc.filesusr.com
• 56840277-152b-4a88-ba14-4b133881100a.filesusr.com
• 9aa4c207-0d80-4b65-a776-918a64622cfc.filesusr.com
• 909ea305-8f66-40ee-855f-fc956213aa6f.filesusr.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report